# How To Limit Failed Sign-in Attempts With BetterShield?
Set how many wrong passwords BetterShield allows, how long a connection is locked out, and how the unlock email, Lockouts list and proof of work work.
In **[BetterShield](/)**, **Sign-in attempt limits** stops password guessing by locking out the connection that keeps getting it wrong. The account is never locked, so its owner can still sign in from anywhere else. It is on by default, under **Sign-in protection** on **BetterShield › Protection › Login & Access**, and the lockouts it makes are listed under **Lockouts** on the same screen.
## What it does
- **Counts failures per connection.** A connection is one IPv4 address, or one IPv6 /64 network. When **Failures allowed** is reached within **Counted within (minutes)**, sign-in from that connection is locked out for **Lockout lasts (minutes)**.
- **What counts:** a wrong password, a username or email address that matches no account, a wrong two-factor code and a wrong application password, on every way WordPress checks a password, XML-RPC included.
- **What never counts:** a refusal BetterShield makes itself, such as a running lockout, an address or user-agent entry on **Never allowed to sign in**, the hidden bot check, an unsolved proof of work, the site lockdown, or a correct password refused by another plugin or because the account signs in with a passkey only. A name on **Never allowed to sign in** locks out the connection on its first try, without the usual few tries (see [Allow and block lists](/docs/allow-and-block-lists/)).
- **While locked out,** the sign-in form tells that connection about how many minutes to wait, and that the link in an email about it, if one came, ends it now. Application passwords from that connection stop working too. Browsing is untouched.
- **Only verified addresses are locked out.** Behind a proxy on a private address that is not named, failures are recorded but nobody is locked out; a proxy on a public address that is not named counts as one visitor, so name it either way. See [Proxies and Cloudflare](/docs/proxies-and-cloudflare/). Addresses on **Always allowed** are not counted at all.
- **Repeats lock out longer.** Each earlier lockout of the same connection within the last day doubles the next, up to a day: with the defaults, 15 minutes, then 30, 60 and so on. A lockout ended with **Release Now** or the unlock link starts the count over.
- **Can tell the server's firewall.** With **Send lockouts to the server’s firewall** on, each lockout also writes one line to the server's auth log, naming the network, for a firewall jail such as Fail2Ban. It is off by default. See [Server firewall](/docs/server-firewall/).
### The unlock email
BetterShield automatically emails a lockout notice only when the account has used that network within the last 30 days, or its correct password was used. On a new network, choose **Email Me an Unlock Link** on the sign-in screen and enter your username or email address. A link is sent only when that lockout qualifies, to the address already saved on the account.
A correct-password notice asks the owner to change their password. A lockout caused by a blocked username, or attempts at several accounts, does not provide an unlock link. The request page gives the same response whether a link can be sent or not.
The link opens **Clear the sign-in lockout?**, which changes nothing until **Clear the Lockout** is pressed, so a mail scanner opening it does not lift the lockout. It works once, only while that lockout runs, and only for sign-in. If someone else was guessing, letting the lockout run out is safer, and the page says so. An account gets at most about one such email an hour.
## Step 1: Open BetterShield › Protection › Login & Access
Open **BetterShield › Protection › Login & Access** and check that **Visitor addresses** in the summary reads **Readable**.
Sign-in protection shows the failure threshold, observation window and lockout duration.
## Step 2: Lock out sign-in after repeated wrong passwords
- Under **Sign-in protection**, turn on **Sign-in attempt limits**. Its numbers open below it.
- Change the numbers if you need to, then press **Save** in the bar at the bottom.
| Option | What it does | Default |
|---|---|---|
| **Sign-in attempt limits** | Counts failures and locks out a connection that reaches the limit. Off, the lists and form limits keep working. | On |
| **Failures allowed** | Failures from one connection before it is locked out: 3 to 100. | 5 |
| **Counted within (minutes)** | How far back failures are counted: 1 to 1440. The proof of work uses the same window. | 15 |
| **Lockout lasts (minutes)** | The first lockout: 1 to 1440. Repeats within a day double it, up to a day. | 15 |
| **Ask for a sign-in puzzle after wrong passwords** | The proof of work, below. It adds a check after wrong passwords. | Off |
When a number differs from its default, "Default:" appears under it with **Use It** to put it back.
## The proof of work: Ask for a sign-in puzzle after wrong passwords
It is asked only after wrong passwords, never on every sign-in. After two failed sign-ins from one connection within **Counted within (minutes)**, the sign-in form says it is checking the browser, and the browser works out a small calculation in the background before the next attempt is accepted. Each further failure makes it a little harder, up to a limit, and it lifts on its own once the counting window passes.
- It needs JavaScript, and the site on HTTPS (or localhost). On plain HTTP the switch says "Needs HTTPS. Your site isn’t using HTTPS yet, so this is off." and sign-ins skip it.
- It needs **Sign-in attempt limits** on, because it reads the same count.
- It appears on the WordPress sign-in page (at a moved sign-in address too) and on the WooCommerce My Account sign-in form.
- It is never asked of unverified connections or **Always allowed** addresses, which are never locked out either, nor of application passwords, XML-RPC, the REST API, WP-CLI or sign-ins sent in the background. The lockout still covers those last five.
- A browser that cannot run it is told to wait a few minutes. An unsolved proof of work never counts toward a lockout.
- The finding **Sign-in doesn’t slow down password guessing** (Low) offers **Apply Fix**, then **Turn On Sign-in Puzzle** and **Yes, Apply It**, with **Undo** afterwards. It cannot be applied while sign-in protection is off, and says "Sign-in protection is off, and the sign-in puzzle needs it. Turn it on in Login & Access first." After a few wrong passwords the next try needs JavaScript.
## Recommended settings
We recommend the defaults, plus the proof of work on any site served over HTTPS: it costs nothing until a connection has failed twice. Keep **Lockout lasts (minutes)** short and let the doubling deal with a connection that keeps coming back. A permanent block belongs on **Never allowed to sign in**, where it is a named decision.
| Site | What we recommend |
|---|---|
| Membership or course site | If many members sign in from one school or company network, add its fixed address to **Always allowed**. If you cannot, raise **Failures allowed** to about 10. |
| Agency or many sites | Add your office's fixed addresses to **Always allowed** on each site, so a colleague's typos never lock out the whole team. |
## What it can break, and how to undo
- **An office behind one address.** Everyone there shares one connection, so one person's typos lock out sign-in for all of them. Add the address to **Always allowed**, or press **Release Now**.
- **A tool with an old password.** An integration sending a stale application password can lock out its own server. Fix its credential, then **Release Now**.
- **The proof of work without JavaScript.** That person waits until the counting window passes, then signs in normally.
- **Getting back in.** Wait for the lockout to end, open the unlock email, ask another administrator to press **Release Now**, run `wp bettershield lockouts release --user=` (or `--all` to let every locked-out connection back in at once), or use your recovery link or `wp bettershield recover`, which pause everything on this screen. See [Locked out](/docs/locked-out/).
To stop locking out altogether, turn the switch off and **Save**. With password confirmation on, that asks for your password.
## Final Outcome
**The Lockouts list.** Each row shows the network (a /24 or /64, the most of an address BetterShield keeps), **Sign-in**, the failed attempts and last username tried, and how long it lasts, with "longer because it came back within a day" for a doubled one. Running lockouts come first, marked **Active** with **Release Now**; ended ones read **Released** or **Expired**, and stay for 30 days. The **Lockouts** tile at the top counts the running ones.
- **The activity log.** "Sign-in failed", "Sign-in lockout started" and "Sign-in lockout cleared".
- **Findings.** **Nothing is limiting sign-in attempts** (High) appears when the switch is off and no other plugin BetterShield recognizes limits sign-ins. **Failed sign-ins are not being counted, so password guessing is not stopped** (High) appears when visitors cannot be told apart. **Two plugins limit sign-in attempts** (Low) appears when this switch is on and another active plugin limits sign-ins too; the switch then says so, with **Choose a Plugin in Quick Setup**.
- **Overview.** After 14 days of history, "Unusual for this site" notes an hour with at least 20 failed sign-ins and more than five times the usual hour.
- **A test.** From a phone on mobile data, sign in to a test account with a wrong password five times. Watch the row appear. On a new connection, use **Email Me an Unlock Link**; an automatic email is conditional. Then press **Release Now**.
Sign-in protection shows the failure threshold, observation window and lockout duration.
## On multisite
An account is the same on every site of a network, but each site counts its own attempts and keeps its own lockouts. The screen says so beside the numbers.
## Related
- [Login & Access](/docs/login-and-access/)
- [Proxies and Cloudflare](/docs/proxies-and-cloudflare/)
- [Allow and block lists](/docs/allow-and-block-lists/)
- [Hidden bot check](/docs/bot-check/)
- [Locked out](/docs/locked-out/)
This is how you can limit failed sign-in Attempts with BetterShield.
Getting Stuck? Feel free to contact our [Dedicated Support Team](/support/).
